New York City · Buffalo · Rochester · Albany
IT support, security and compliance for New York companies.
Remote help desk, security monitoring, compliance and vCIO for New York businesses and the people who work for them, from New York City to Syracuse.
New York's economy
The industries that drive New York, and how we help them.
The securities industry generated 19.4% of all New York State tax collections in fiscal year 2024-25 and accounted for 17.7% of New York City's gross product in 2023, with a record 201,500 city jobs in 2024.
How we help: Security programs that stand up to customer and examiner questionnaires: MFA, logging, vendor oversight and written policies, plus SOC 2 readiness.
How we help →Health care and social assistance is New York's largest employment sector, with more than 1.9 million jobs and over 20% of all jobs in 2024.
How we help: EHR support, HIPAA compliance, telehealth and help desk for practices without IT staff.
Healthcare →New York is one of CompTIA's top five states for tech employment, and the NYC Comptroller reports tech accounts for about 5% of city jobs but almost 10% of wage and salary income.
How we help: SOC 2, security questionnaires, remote teams and board-level IT guidance for firms that hold client data.
Software & professional services →New York City welcomed 65 million visitors in 2025, generating $84.7 billion in total economic impact and supporting 397,000 jobs.
How we help: Guest Wi-Fi kept apart from business systems, card-payment systems kept tightly scoped, and help desk cover for seasonal staff.
How we help →New York rules
The New York laws that affect your IT.
A breach, a privacy request or an auditor's question lands differently in every state. Here is what New York asks of businesses that hold its residents' data.
Data-breach notification
- The law
- N.Y. Gen. Bus. Law § 899-aa, as amended Dec. 2024 (30-day deadline and DFS notice), Feb. 2025 (DFS notice limited to DFS-regulated entities) and effective March 21, 2025 (medical and health insurance information added)
- Telling affected people
- "within thirty days after the breach has been discovered" (in effect since Dec. 21, 2024; replaced "the most expedient time possible and without unreasonable delay"). Delay is permitted only for law enforcement needs.
- Regulators
- If any New York resident is notified, the business must notify the Attorney General, the Department of State and the Division of State Police about the timing, content and distribution of the notices and the approximate number affected; there is no minimum resident threshold. DFS-regulated covered entities (23 NYCRR 500) must also notify the Department of Financial Services.
- Credit bureaus
- Required when more than 5,000 New York residents are to be notified at one time.
- Encrypted data
- Encrypted data is generally exempt (a safe harbor), unless the key was also compromised.
Consumer privacy law
New York has no comprehensive consumer privacy law. The New York Health Information Privacy Act (S929) passed in 2025 but was vetoed by Gov. Hochul in December 2025. A revised NYHIPA (S9269/A10357) passed the Senate on June 3, 2026 and the Assembly on June 4, 2026, and was awaiting the Governor's decision at the time of writing. If signed, it would regulate health information of New York residents held by companies of all sizes, with HIPAA-covered PHI exempt.
Other New York rules worth knowing
Who: Any individual or organization operating, or required to operate, under a license, registration, charter, certificate, permit or similar authorization under the New York Banking Law, Insurance Law or Financial Services Law (banks, insurers, agents and brokers, lenders, money transmitters and others).
Covered entities must maintain a risk-based cybersecurity program and CISO. They must notify DFS within 72 hours of determining a cybersecurity incident has occurred, report any extortion payment within 24 hours and certify compliance annually by April 15. Under the Second Amendment (Nov. 2023), universal MFA and a written asset inventory were required from Nov. 1, 2025.
SourceWho: Any person or business that owns or licenses computerized private information of a New York resident, regardless of where the business is located. Small businesses (fewer than 50 employees, under $3M revenue or under $5M assets) may scale safeguards to their size.
Businesses must develop, implement and maintain reasonable administrative, technical and physical safeguards, such as a designated security coordinator, risk assessments, employee training, vendor contracts, control testing and secure disposal. Entities compliant with GLBA, HIPAA/HITECH or Part 500 are deemed compliant, and the Attorney General enforces the law.
SourceCurrent as of November 2026. This is general information, not legal advice. Laws change, so confirm the details with counsel before relying on them. We help you put the controls in place and keep the evidence; we are not a law firm.
Supporting New York teams
Remote by design, wherever your people work.
Our standard hours, 8am to 6pm Central, are 9am to 7pm Eastern. Critical problems are covered nights and weekends.
Eastern Time (ET)Laptops shipped ready to work, accounts set up on day one, and the same help desk whether someone is in New York City or working from home.
Help desk & managed ITMFA, managed endpoint protection and monitoring on every device, so a laptop on home Wi-Fi is held to the same standard as the office.
CybersecurityCustomers and staff in several states means several sets of rules. We map which apply and build one program that satisfies them.
SOC 2 · HIPAA · vCISONew York questions we get asked
How quickly must a New York business notify people after a data breach?
Under N.Y. Gen. Bus. Law § 899-aa, as amended Dec. 2024 (30-day deadline and DFS notice), Feb. 2025 (DFS notice limited to DFS-regulated entities) and effective March 21, 2025 (medical and health insurance information added): "within thirty days after the breach has been discovered" (in effect since Dec. 21, 2024; replaced "the most expedient time possible and without unreasonable delay"). Delay is permitted only for law enforcement needs.. If any New York resident is notified, the business must notify the Attorney General, the Department of State and the Division of State Police about the timing, content and distribution of the notices and the approximate number affected; there is no minimum resident threshold. DFS-regulated covered entities (23 NYCRR 500) must also notify the Department of Financial Services.
Does New York have a consumer privacy law?
New York has no comprehensive consumer privacy law. The New York Health Information Privacy Act (S929) passed in 2025 but was vetoed by Gov. Hochul in December 2025. A revised NYHIPA (S9269/A10357) passed the Senate on June 3, 2026 and the Assembly on June 4, 2026, and was awaiting the Governor's decision at the time of writing. If signed, it would regulate health information of New York residents held by companies of all sizes, with HIPAA-covered PHI exempt. That does not make you exempt from other states' laws: if you serve customers elsewhere, their states' rules can still apply.
Can you support our employees who work remotely in New York?
Yes. Help desk, device management, security monitoring and compliance all run remotely, and many of our clients have staff spread across the country. Our standard hours, 8am to 6pm Central, are 9am to 7pm Eastern for your New York team, and critical problems are covered nights and weekends.
Do you come on site in New York?
Our on-site visits are in Texas. In New York, our work is remote, which covers most of what companies need. When something needs hands on hardware, we arrange local help and coordinate it for you.
Thirty minutes, and you will know where you stand.
Thirty minutes, no obligation. Tell us about your New York team and we will tell you what we would do and what the ceiling would be.